P0: fix(auth): ignore incomplete OTP submissions - #216
Conversation
🦋 Changeset detectedLatest commit: 48964db The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🚅 Deployed to the pr-80d44f-216 environment in ePDS
|
Coverage Report for CI Build 30955306853Coverage remained the same at 57.909%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
aspiers
changed the title
aspiers
left a comment
aspiers
left a comment
There was a problem hiding this comment.
The intention is good here but very flawed testing.
|
The PR-attached E2E check is red only because its SHA-specific Railway deployment lookup timed out before the preview deployment was discoverable. The same commit passed the full deployed suite when run explicitly against |
e244ebd to
ce5653a
Compare
|
(reply generated by OpenAI Codex) Closing and reopening the PR created a fresh Railway preview for the unchanged current SHA. The required check has now run the full E2E suite and passed: https://github.com/hypercerts-org/ePDS/actions/runs/30557766403 |
ce5653a to
aa1abc7
Compare
The incomplete-submit guard silently swallowed the click, so Verify looked live but did nothing until every box was filled. Render the button disabled and drive its state from the filled-slot count, so an incomplete code is visibly un-submittable rather than a dead click. The submit-handler guard stays as a backstop: Enter, autofill and requestSubmit() all reach submit without going through the button. Sync from updateHiddenCode()/clearOtpBoxes() — the two chokepoints where the code value changes — plus once at load, so a bfcache-restored page that repopulates the boxes without firing input can't strand the button disabled. The helper bails while verifying or after the flow is aborted; those owners disabled the button for reasons unrelated to length. That also replaces the unconditional re-enable on the failed-verify path, which would otherwise re-enable Verify over the boxes it just cleared. Drop the disabled button to 0.6 opacity so it reads as inert; 0.6 is the floor that keeps the white label at ~4.9:1 on the default brand colour (WCAG AA). Stop :hover brightening a disabled button, which read as clickable. The e2e steps now submit the form directly rather than clicking, since a disabled button is never actionable, and assert the disabled state. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
c0f0867 to
48964db
Compare
|
1 participant
Summary
Stop empty or partial verification codes before they reach better-auth. This avoids misleading invalid-code errors and prevents incomplete submissions from spending a verification attempt.
Verify is disabled until every OTP slot is filled, so an incomplete code is visibly un-submittable rather than a click that silently does nothing. The submit-time guard remains as a backstop for the paths that reach submit without the button (Enter, autofill,
requestSubmit()).Changes
:hoverbrightening itTesting
pnpm format:checkpnpm lintpnpm typecheckpnpm testpnpm test:coverageScreenshots
Before: submitting a partial code sent it for verification and showed a misleading invalid-code error. The preview response was controlled to isolate this state.
After: clicking Verify with only part of the code entered sends no verification request, leaves the controls editable, and shows no false error.
Notes
mainat a6cf09d; conflicts with the newer “Use different email” coverage were resolved by retaining both behaviors.main.@verify-incomplete-otpscenarios.